MAL-2026-14176

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dev-env-check/MAL-2026-14176.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14176
Published
2026-08-18T23:57:37Z
Modified
2026-08-19T00:30:15.936860142Z
Summary
Malicious code in dev-env-check (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35)

On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe (Invoke-WebRequest with -WindowStyle Hidden, -NoProfile, -NonInteractive, -UseBasicParsing) to download https://update.setuponline.click/update to %TEMP%\msedgeupdate.exe and then executes it detached via execFile with windowsHide. The C2 URL, the dropped filename, the powershell.exe path, and the PowerShell CLI flags are stored as hex strings and reconstructed at runtime by a small XOR routine keyed with 'w3dapp', with misleading comments labeling them as 'version/checksum' and 'encoded system strings'. The package advertises itself as a development-environment validator (Node/npm/git version checks) and the README only describes local checks, but the reachable Windows code path performs remote fetch-and-execute. The filename msedgeupdate.exe impersonates a Microsoft Edge update; update.setuponline.click is not a Microsoft domain.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:12.065834114Z",
            "sha256": "ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35",
            "modified_time": "2026-08-18T23:57:37Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018239",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dev-env-check

Package

Name
dev-env-check
View open source insights on deps.dev
Purl
pkg:npm/dev-env-check

Affected ranges

Affected versions

1.*
1.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dev-env-check/MAL-2026-14176.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "ea7dfbb92fe9a6e79f748bdff7bba75fbe01f09f0a37ec1678d4d09541a72287",
            "path": "lib/platform-compat.js",
            "tlsh": "f3411046f5e7223990fda8e1679b243d314f62617256d140be8c46cc4f83635c661e99"
        },
        {
            "sha256": "d4670a087536e688c03d411bb9a2f69b3099defd019079c020011c2749c17a24",
            "path": "package.json",
            "tlsh": "f6f04624c9349d7369d422967c5a8046b3b24e0b49087e0c33cb025c8badb7f56bf92e"
        }
    ],
    "package_integrity": [
        {
            "filename": "dev-env-check-1.0.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-/RL66w2Nh6UdoZtCZjOK7ZgEDhmfcyqqD0f64g3qUv8qQuWXsIJ2CUOW9OsFfz4OZjIDzfzH0em0EWz378FQnQ==",
                "sha1": "1ff393cfb793d9df5053ef7b68424093a93e0ccd"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]